MA
Product
Mattermost
290
CVEs
0
On KEV
9.9
Max CVSS
22
New 30D
Severity mix
Critical 7High 34Medium 222Low 31
Watch
Add Mattermost to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2026-4858 | 9.9 | May 21 | Path traversal in integration action URL leading to arbitrary API execution via system admin’s auth token. Affected: 11.6.0 through 11.6.0; 11.5.0 through 11.5.3; 11.4.0 through 11.4.4; 10.11.0 through 10.11.14 |
| CVE-2025-12421 | 9.9 | Nov 27 | Account Takeover via Code Exchange Endpoint Affected: 11.0.0 through 11.0.2; 10.12.0 through 10.12.1; 10.11.0 through 10.11.4; 10.5.0 through 10.5.12 |
| CVE-2025-12419 | 9.9 | Nov 27 | Account takeover on OAuth/OpenID-enabled servers Affected: 10.12.0 through 10.12.1; 10.11.0 through 10.11.4; 10.5.0 through 10.5.12; 11.0.0 through 11.0.3 |
| CVE-2024-39777 | 9.6 | Aug 1 | Mattermost versions 9.9.x <= 9.9.0, 9.5.x <= 9.5.6, 9.7.x <= 9.7.5 and 9.8.x <= 9.8.1 fail to disallow unsolicited invites to expose access to local channels, when shared channels… Affected: 9.5.0 before 9.5.7; 9.7.0 before 9.7.6; 9.8.0 before 9.8.2; 9.9.0 |
| CVE-2026-12985 | 9.3 | Sep 14 | Mattermost DCR redirect URI allowlist bypass via improper URL component validation Affected: 11.9.0 through 11.9.0; 11.8.0 through 11.8.4; 11.7.0 through 11.7.7 |
| CVE-2023-2193 | 9.1 | Apr 20 | Mattermost fails to invalidate existing authorization codes when deauthorizing an OAuth2 app, allowing an attacker possessing an authorization code to generate an access token Affected: 7.1.7; 7.7.3; 7.8.2; 7.9.1 |
| CVE-2019-20851 | 9.1 | Jun 19 | An issue was discovered in Mattermost Mobile Apps before 1.26.0 Affected: before 1.26.0; before 1.26.0 |
Showing 7